Bithumb hacked via staff system; exchange says no crypto lost

Bithumb, South Korea's second-largest crypto exchange by trading volume, says an outsider broke into an internal system used by its employees and stole personal information. No cryptocurrency was reported lost as of Wednesday afternoon in Asia, and the exchange insists customer assets could not be reached through the breached system, CoinDesk reports, citing Korean media.

What Bithumb has disclosed

• The target: a mobile app staff use to work and message each other, not the exchange itself.
• When: the intrusion was found on Tuesday, 27 October, and reported to the Korea Internet & Security Agency (KISA) and the Personal Information Protection Commission.
• Customer data: Bithumb told Yonhap it is still working out the exact scope, "including the possibility of member information being involved."
• Funds: the system runs separately from trading, so "customer virtual assets cannot be accessed through this breach," the exchange said.
• Still unknown: how many people are affected and whether deposits or withdrawals were disrupted.

Part of a wider wave in Korea

Bithumb was one of three financial firms the Financial Supervisory Service (FSS) said it was assessing on Wednesday. Brokerage Daishin Securities said personal and credit data of 38,490 customers leaked in an outside attack, while Mirae Asset Global Investments said it blocked abnormal access to some web systems without investor data being affected. FSS Governor Lee Chan-jin said earlier this month that cyberattacks had hit 16 Korean financial firms as of 14 October. Seoul was already tightening the rules: see our report on the cybersecurity overhaul for Korean crypto firms.

It is also the second control failure at Bithumb this year. In February the exchange mistakenly credited customers with 620,000 BTC, worth more than $40 billion at the time, instead of 620,000 won.

What it means for users

Even when no coins move, leaked names, phone numbers or emails are fuel for phishing. Expect messages pretending to be Bithumb "security checks", and never share passwords, one-time codes or a recovery phrase. Our guide on how to spot crypto scams lists the common scripts, and how to store crypto safely explains why long-term savings are better kept off exchanges.